CVE-2018-15601

Vulnerability

The vulnerability exists in Elefant CMS version 2.0.3 in apps/filemanager/handlers/upload/drop.php. The upload mechanism attempts to block executable files (with extensions such as .php, .phtml, .js, .rb, .py, .pl, .sh, .bash, or .exe) by checking the file extension using a regular expression. However, the call to urldecode() on the filename is performed after this extension check, not before. This means that if an attacker URL-encodes characters in the filename (e.g., shell%2ephp), the extension check sees the encoded version (which does not match the blocked patterns), but the file is saved with the decoded name (e.g., shell.php), bypassing the protection [1][2].

Exploitation

An attacker must have access to the file upload functionality typically available to authenticated users with appropriate permissions to upload files. The attacker crafts a filename that includes a URL-encoded representation of the dot character (e.g., %2e) before a blocked extension (e.g., %2ephp). The filename, such as shell%2ephp, passes the regex check because the dot is encoded. After the check passes, the urldecode() call converts %2e back to ., resulting in the file shell.php being written to the server [2].

Impact

A successful attack allows an unauthenticated (or low-privileged) user to upload arbitrary executable files (PHP, etc.) to the server. This can lead to remote code execution (RCE) by subsequently accessing the uploaded file, and the attacker can achieve full compromise of the web application and potentially the underlying server [1].

Mitigation

The issue was fixed in commit afb3346 to the Elefant CMS repository. The fix moves the urldecode() call to occur before the extension check, so the decoded extension is evaluated [2]. Users should update to a version of Elefant CMS that includes this commit (version 2.0.4 or later). If an upgrade is not immediately possible, a workaround is to disable file upload functionality or apply the commit patch manually. No KEV listing exists for this CVE.